CVE-2026-61852

What it is

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery() implementation in server/modules/ai/orchestrator/tools/runQuery.js interpolates the AI tool's row_limit parameter into a SQL LIMIT clause without runtime integer validation. The read-only keyword check runs before this value is appended, so an authenticated user who can influence a model-generated non-integer row_limit can add SQL that bypasses the earlier check. Successful exploitation can execute arbitrary statements against the connected database, including reading or changing data and, where database permissions permit, accessing files or executing operating-system commands. This issue is fixed in version 5.2.2.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account. Limited direct impact.

Exploit odds

0.4% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-09-21 22:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-24 23:17 UTC Last updatedMost recent change to the record

Details

Published

2026-09-21 22:16 UTC

Last modified

2026-09-24 23:17 UTC

Exploit probability

0.4% · EPSS, next 30 days

Weakness

CWE-89 · SQL injection

Record status

Deferred

Attack profile CVSS 4.0 · 5.8

Attack vector

Network

Complexity

Low

Attack requirements

Present

Privileges needed

Low

User interaction

None

Confidentiality

None

Integrity

None

Availability

None